8

Kubernetes API request curl https://192.168.0.139 --cacert /home/mongeo/ku-certs/ca.pem return Unauthorized

Request curl localhost:8080 worked good.

My kube-proxy and kube-apiserver standart (coreos+k8s tutorial)

How do I get data on HTTPS?

3
  • add 443 port address for https
    – Shiv Singh
    Dec 16, 2015 at 7:31
  • try curl 192.168.0.139:443 --cacert /home/mongeo/ku-certs/ca.pem
    – Shiv Singh
    Dec 16, 2015 at 7:31
  • @ShivSingh Singh It does not help
    – batazor
    Dec 16, 2015 at 7:40

6 Answers 6

8

Did you specify --token-auth-file=<file> and/or --basic-auth-file=<otherfile> or one of the other authentication modes? I don't know that https endpoint will work without one of these (maybe it should, but it doesn't, apparently). Check out https://kubernetes.io/docs/admin/authentication/

1
  • 4
    How it will help open the page in a browser? The token must be passed in cheder page requests?
    – batazor
    Dec 17, 2015 at 4:11
3

Hi this is what I did for token,

  1. Find address Server Api

    • open /etc/kubernetes/kubelet.conf

      example: server: https://10.1.32.120:6443

  2. Find token

    • open /etc/kubernetes/pki/tokens.csv

      example: 4c95a1a22d19b20811,kubeadm-node-csr,07ccbf35-e206-11e6-ab8f-0010184e550e,system:kubelet-bootstrap

  3. In this case the token is 4c95a1a22d19b20811
  4. If use postman, add header Authorization: Bearer 4c95a1a22d19b20811
1
  • 1
    i can't find token.csv in my /etc/kubernetes/pki/ directory. Do we need to add the token file ourselves?? Dec 14, 2020 at 10:49
1

A simple way to access the Kubernetes API from an external network is to create an SSH tunnel, e.g.

ssh -L 9000:localhost:8080 roto@master.node

This will forward connection from your local port 9000 to localhost:8080 on your server.

As long as the SSH tunnel is open, you can query the API on port 9000 of your machine.

1
  • kubectl proxy is an easier way to establish a local http tunnel to the API server.
    – phs
    Jun 26, 2019 at 18:57
0

There are several ways to authenticate in the API. Simplest way for you to get authorized is to send Authentication header with "bearer TOKEN_VALUE" value. You can look at Kubernetes API configuration on your server to look up defined tokens. The header can be sent with http request using web browser extension.

0

finally, i figured this out:

lincai@pdbuddy:~/blackbox$ curl -v --cacert ./ca.pem --key ./admin-key.pem --cert ./admin.pem  https://xxxx/api/v1/
* Hostname was NOT found in DNS cache

> 
< HTTP/1.1 200 OK
2
  • Great! If you want to use a file from the current directory, please precede it with "./" prefix, in order to avoid confusion with a nickname.
    – 8.8.8.8
    Aug 9, 2018 at 5:33
  • I observed that in my environment, if i dont use "./" prefix, I get unauthorized error. I am running the command from the folder where there are certificates so why does it not work ? This is what I am trying and it did not work curl https://x:x:x::6443/api/ --key kubernetes.key --cert kubernetes.crt --cacert ca.crt and this works curl https://x:x:x::6443/api/ --key ./kubernetes.key --cert ./kubernetes.crt --cacert ./ca.crt
    – srinu259
    Apr 25, 2020 at 10:19
-3
curl https://192.168.0.139 —key ./admin-key.pem —cert ./admin.pem —cacert ./ca.pem
1
  • 3
    Add an explanation for the OP. It will help him understand better.
    – Haris
    Dec 17, 2015 at 4:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.